Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
Summary: Anthropic said an unreleased internal AI model found flaws in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits, including one that opened the Calculator app on a stock Mac running Chrome within seconds of a page loading with no further clicks. Anthropic reported every flaw to vendors first and all are patched; it says it reported 62 flaws to Google that were assigned CVEs and fixed as of Chrome 156, all rated critical or high, including 13 sandbox escapes, while Apple credits Milad Nasr and Nicholas Carlini with Claude for a Safari fix in iOS and iPadOS 26.5.2.
Why it matters: The capability claim rests on Anthropic's own account: it does not name the model, does not break down what a person did at each step, and for the Windows bug the public CVE record names no finder at all, so the question a security leader has to sit with is how much of each chain the model actually built on its own.
Read the original at The Hacker News ↗
- Mentions
- CVE-2026-33096
- Related